European Data Protection Board (EDPB) releases smart glasses statement

What are smart glasses?

The Statement defines smart glasses broadly as wearables that often look like regular glasses or sunglasses and incorporate computing capabilities such as cameras, microphones, speakers or software (including AI systems), and which may connect to the internet, other devices or mobile applications.

The EDPB notes that smart glasses often cannot be easily recognised, and that non-consensual recording (both audio and visual), especially in “sensitive” contexts, such as those where minors are present, or where medical data is being shared, is a particular area of concern.

Transparency

The EDPB notes that compliance with the GDPR’s transparency requirements is a “major challenge”. The responsible controller could, depending on the circumstances, be the user, the device manufacturer or the provider of a linked application or service.

The EDPB considers that traditional privacy notices might not be appropriate to inform bystanders. Instead, the EDPB recommends other measures such as clearly visible recording indicators (e.g., LED lights or sounds) that (i) operate by default, (ii) are difficult to disable and (iii) are easy for bystanders to notice.

Legal basis

The EDPB also notes that manufacturers and service providers will likely find it difficult to obtain valid consent from bystanders. In particular, it notes that consent obtained after recording would not be valid. Reliance on legitimate interests will require a careful case-by-case analysis and sufficient mitigating measures.

The EDPB considers this would be particularly difficult to justify for processing that goes beyond the service the user has requested, such as using footage for commercial purposes or AI training, which bystanders would not reasonably expect.

The household exemption

Wearers acting in a purely personal capacity may fall within the GDPR’s household exemption (Article 2(2)(c))—for example, when sharing a photo or video only with a family member or friend, or using the device for personal translation in a private context.

However, this exemption should be narrowly construed in line with EU case law. It would not apply, for example, where footage is shared with an indefinite number of people on a public social media account, or where the glasses are used for official, professional or political activities.

Other applicable laws

Even where the GDPR does not apply, users may be subject to other laws, including criminal, civil or labour law. The ePrivacy framework may also apply, as smart glasses may in some circumstances qualify as “terminal equipment”.

Manufacturers and service providers

The EDPB also stresses that the GDPR still applies to device manufacturers and providers of linked applications or services (including AI systems), even where the user benefits from the household exemption.

These actors may be independent or joint controllers where they determine the purposes and means of the processing—for example, where an AI provider analyses images from the camera feed to answer a user’s query—and they cannot rely on users’ actions to meet their own GDPR obligations.

Next steps

The EDPB notes that it will continue to analyse privacy concerns raised by the use of smart glasses and similar audio-visual devices, to assist users, producers, controllers and related third parties.

For further details, please see the Statement.